hxxps://gofile[.]io/d/TrO0QU

Analysis

user interaction
yes
max time kernel
125s
max time network
127s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/TrO0QU
Sample260502-bec3eaby4p

Score

8^/10

microsoft defense_evasion discovery phishing

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
71	2976	msedge.exe

A potential corporate email address has been identified in the URL: [email protected]
phishing

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
34	api.gofile.io
35	api.gofile.io
37	api.gofile.io

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
288	2976	msedge.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1336_125656305\nav_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1336_1336503622\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1336_827033788\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1336_827033788\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1336_125656305\manifest.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Mad-Installer.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2976	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134221573974167265"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{87B558A2-7E48-42C2-A42F-561A26A129C2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Mad-Installer.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
956	msedge.exe
956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4532	CredentialUIBroker.exe
4648	CredentialUIBroker.exe
2884	CredentialUIBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 4408	1336	msedge.exe	80
PID 1336 wrote to memory of 2980	1336	msedge.exe	82
PID 1336 wrote to memory of 2976	1336	msedge.exe	81
PID 1336 wrote to memory of 2980	1336	msedge.exe	82
PID 1336 wrote to memory of 2980	1336	msedge.exe	82
PID 1336 wrote to memory of 2724	1336	msedge.exe	83
PID 1336 wrote to memory of 2724	1336	msedge.exe	83
PID 1336 wrote to memory of 3932	1336	msedge.exe	84
PID 1336 wrote to memory of 4688	1336	msedge.exe	85
PID 1336 wrote to memory of 3932	1336	msedge.exe	84
PID 1336 wrote to memory of 3932	1336	msedge.exe	84
PID 1336 wrote to memory of 4688	1336	msedge.exe	85
PID 1336 wrote to memory of 4688	1336	msedge.exe	85
PID 1336 wrote to memory of 2132	1336	msedge.exe	87
PID 1336 wrote to memory of 3360	1336	msedge.exe	88
PID 1336 wrote to memory of 3328	1336	msedge.exe	89
PID 1336 wrote to memory of 2132	1336	msedge.exe	87
PID 1336 wrote to memory of 2132	1336	msedge.exe	87
PID 1336 wrote to memory of 3360	1336	msedge.exe	88
PID 1336 wrote to memory of 3360	1336	msedge.exe	88
PID 1336 wrote to memory of 3328	1336	msedge.exe	89
PID 1336 wrote to memory of 3328	1336	msedge.exe	89
PID 1336 wrote to memory of 4468	1336	msedge.exe	90
PID 1336 wrote to memory of 4468	1336	msedge.exe	90
PID 1336 wrote to memory of 4468	1336	msedge.exe	90
PID 1336 wrote to memory of 3988	1336	msedge.exe	92
PID 1336 wrote to memory of 3988	1336	msedge.exe	92
PID 1336 wrote to memory of 2200	1336	msedge.exe	93
PID 1336 wrote to memory of 2200	1336	msedge.exe	93
PID 1336 wrote to memory of 2200	1336	msedge.exe	93
PID 1336 wrote to memory of 3648	1336	msedge.exe	95
PID 1336 wrote to memory of 3648	1336	msedge.exe	95
PID 1336 wrote to memory of 2296	1336	msedge.exe	96
PID 1336 wrote to memory of 2296	1336	msedge.exe	96
PID 1336 wrote to memory of 3724	1336	msedge.exe	97
PID 1336 wrote to memory of 3724	1336	msedge.exe	97
PID 1336 wrote to memory of 4572	1336	msedge.exe	98
PID 1336 wrote to memory of 2908	1336	msedge.exe	100
PID 4572 wrote to memory of 1080	4572	msedge.exe	101
PID 1336 wrote to memory of 4256	1336	msedge.exe	102
PID 1336 wrote to memory of 4256	1336	msedge.exe	102
PID 1336 wrote to memory of 2192	1336	msedge.exe	103
PID 1336 wrote to memory of 2192	1336	msedge.exe	103
PID 1336 wrote to memory of 2336	1336	msedge.exe	104
PID 1336 wrote to memory of 2336	1336	msedge.exe	104
PID 1336 wrote to memory of 2392	1336	msedge.exe	105
PID 1336 wrote to memory of 2392	1336	msedge.exe	105
PID 1336 wrote to memory of 1004	1336	msedge.exe	106
PID 1336 wrote to memory of 1004	1336	msedge.exe	106
PID 1336 wrote to memory of 3200	1336	msedge.exe	107
PID 1336 wrote to memory of 3200	1336	msedge.exe	107
PID 1336 wrote to memory of 3200	1336	msedge.exe	107
PID 1336 wrote to memory of 2356	1336	msedge.exe	108
PID 1336 wrote to memory of 2424	1336	msedge.exe	109
PID 1336 wrote to memory of 2356	1336	msedge.exe	108
PID 1336 wrote to memory of 2424	1336	msedge.exe	109
PID 1336 wrote to memory of 2424	1336	msedge.exe	109
PID 1336 wrote to memory of 4624	1336	msedge.exe	110
PID 1336 wrote to memory of 1380	1336	msedge.exe	113
PID 1336 wrote to memory of 4696	1336	msedge.exe	114
PID 1336 wrote to memory of 3548	1336	msedge.exe	115
PID 1336 wrote to memory of 836	1336	msedge.exe	116
PID 1336 wrote to memory of 836	1336	msedge.exe	116
PID 1336 wrote to memory of 836	1336	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/TrO0QU
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x214,0x250,0x7ffcc73cc188,0x7ffcc73cc194,0x7ffcc73cc1a0
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,492604468008505892,6905272709187949033,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - Detected potential entity reuse from brand MICROSOFT.
  - System Time Discovery
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,16454405478777283492,4089735846119058049,262144 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,14078907597174143946,3123540083757116662,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:13
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,7452903762823402431,12149495183330433674,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,13145632376355965368,17259360591369600404,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4104,i,8528942116203510635,347752514472148827,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4116,i,6721080274192141533,11502257409369100850,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:9
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4128,i,616246174662258910,18329684741735022948,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4180,i,17986781501518249877,8172868706306625617,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,4028467733864525640,16705999969297377635,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:14
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3508,i,5965666088889292287,17580420951962073709,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,13653301220628528454,10684761877214120152,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,6253551742122277938,13285669061607162192,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,12455601640105368296,14865356674449405010,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,3579775530878104337,10144426018059195334,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,5523423928106411470,15915990611905947212,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,5523423928106411470,15915990611905947212,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,4530632313094563633,11379718122370873941,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,3446297971461399985,12022334576850024491,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,5300914306397809897,18158260738451582309,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,10564005943609356035,879682873341433880,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,13371973240254859833,12197023824057771856,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6668,i,6719165149064562153,16453286456505641583,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,992499151085424532,10301173429811849393,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5396,i,7105428384933783034,13235647193605092870,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7144,i,10568472190898188768,469592076184974830,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,9898943421521279196,3142393106058127199,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,3445822747265390592,15233119556227707282,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,17995509256620705412,11414760821743398279,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6692,i,3223284470972615661,16408621551911113403,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=4504,i,684974189354453423,16104067182401199267,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6792,i,15787862651952603596,15399954738037569648,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5028,i,14903299687046615432,17955986065792785953,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=6684,i,15070156216846673100,8699464778792571427,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,6528204899902628832,15002653302041886283,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:14
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=6004,i,18344698512414736373,15640827756443739533,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7188,i,14585441729545457693,14220424406654787021,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=6884,i,999370852843266793,4393689833803177976,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7512,i,1829086807362767799,11858622428973801050,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:14
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=5048,i,6607196705729157486,304517073870289088,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=5860,i,579133886308674996,5137452017198160631,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7500,i,6060649816427569943,16146116900694688628,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,9330310534550132836,1898467620258803042,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:14
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,1252759690862762991,15137482910690248475,524288 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7412,i,14520312014485564096,14202761261306619484,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=3516,i,2545516398174146969,8081283740258213097,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=2848,i,1690718796514069080,11544575458492577057,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=5048,i,583188642151453137,6300212833400418815,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=6884,i,13973173933132693915,14379853677677852176,2097152 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5500,i,12328113130910543806,4175257300682478980,262144 --field-trial-handle=2156,i,17645330287551799305,7059810869752629643,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4908

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1580

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4532

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4648

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2d706fc7-ffe7-4e71-9b1c-9889dfe81118.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2d706fc7-ffe7-4e71-9b1c-9889dfe81118.tmp
Size 392B
SHA256 467927d833b3e915cad2b54806e1f9624b739c54a5d9bf97ddc25704088883f0
MD5 eacf232413ee13cb8a276a3d82d62171
SHA1 d02ce2ea70c107733ab4fc7f724a05624707d11f
SHA512 67e2119e03dea07c45ec01d1a0514f1d99d301dc835680587b9d3c89da1a192883caf5bed80d455189019c0313951206b332b67fbe11cb2df61d7561934a99a5
TLSH
T1D6E00283F30004BAD02C57300143162026E6903002B202465D2002643C133001E34B80
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2aacdc92934042d4caa99596522ee1e193754401b06f2ae423d02a6a1ffb95f0
MD5 976993b38796533bfd2e473e764bacbf
SHA1 ec36415031f95b63d06909960fa49f8e4ef0bbb2
SHA512 337b39037197eda19a326896fd3cdd19d8cc8e7a87a21524ed6a7a1a9da642bf205b3c1a05b5f9d946fabb484ee9e51116a64694792a5d8aaca0d30e2927eb82
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T122B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 eacd218daf22fcefbc23ae70ce919d8ac95b89c3f7d038f647296c47a218fc46
MD5 35b0754e7f5b0bef0f59e6474c3c9e30
SHA1 a5dbcd61883043544b184e46e47beb3bf5d259a8
SHA512 0a14f00d3bf385bd104004e3adb021fc5b135483b30669a0f446d235f67bf00d734e76a56ac18adc3d6765163a992c78b2c6833f0e764506a9c06ff2ad8fc90e
TLSH
T1ECD0801452F17C64C2E65975484677153D1DD4E346C3537225A3267C4C461881C953C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7173f2853e3b591f142ed047bb6a2ea62d5d817f9016fdd31efbebd88f820e91
MD5 9093390d9e798f9a4ccc25251c10fea5
SHA1 96837bd82509feb4ca69a53466162950148f0394
SHA512 4db01b0d83eba59662ef7f147a96bb0034c92f2c5d5ac83ceeae12ddc800fe8dbce64d41320c2a3031796e981edc605460e3a1da207a6a9d39812740085a86ef
TLSH
T1A7D0801412F17C64C6E65975484577153D1DD4E346C3537325A3267C4C471C81C953C7
MD5 SHA1 SHA512 TLSH

Submit Download

67dde93a-ed35-4587-b46e-99a08bb0066c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\67dde93a-ed35-4587-b46e-99a08bb0066c.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 34KB
SHA256 afd4782e0b7442187ef3334e0dd04804eec2f7e78b66f2486e9aad0e2c0f415d
MD5 86838477fc764344efbfb59db3377e02
SHA1 975ba960ae9f272dcbbffa0bb4846ae66a217bca
SHA512 c070be0783368b0cfc2c82c404a77b3d3a54d4fa7276947675c29af0c0f1596c0820ab6b7f55ffef78204b6270599e52685c465a5e5a14719affedfcc6e5171c
SSDEEP 768:UyU08MPVeXS+IFU8EHGmvKhcxSDctxyvsi0PD:IsdeCV5mG3hcwwLyX0b
TLSH
T1AFF2E1309D56284B8376EC684F46B9E2D4953252873AB157063E974835F13ECB3899CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 97KB
SHA256 08c1ade001a530f1e243f27f19e1b070ac4b43ed38dd3bb1d7c40715dc4c87f2
MD5 171a26291b479857a5abeaece2104b09
SHA1 82a1796ad885412da94a5f0f15e91f3e07ca888d
SHA512 9ca77cc7db39ee4dffae42300e1494f9f8fbd6233d7740e9e9d5679b7d8979a58bc8ea510262719af0b4941a62584cafc404f0e8a875fa90baa0a9c1a5af93ac
SSDEEP 1536:wq/tCttbQz328dc9mqGiTLFu5ptbSOcOL1Rnz/Cl0jMHweWcPJsD/gPG2wMpatK:wq/tCjbrYUmqGiTLc3BBHMHweEkw4atK
TLSH
T10CA31289F732DB1F9313943896AC73046FC80367244986FE104FB9D32EDA55B2276D6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 67KB
SHA256 22c049127db81ba96560519661e2b4a83e1fbaf287e88899bff7a603cbbf9e98
MD5 8586f2757e05c54de8aa995e874469f8
SHA1 8f243992250c6f821961ffa09cf8f8faa21fd603
SHA512 03e0e256c16b342af11b8809a16d18700bb9e04767e95b17a765fba8899c685095d81383357551ced61c2945f2da19f5932a85a8f816ea7dbe757131e5cde063
SSDEEP 1536:GfGISOIzFx2M/oy8lBSFPazurVF0NGoPbdiEL6pFe+zxSY22hIU4m:GfLuF87EazWVEjbQEFwG2hD4m
TLSH
T1D7630273C1004A0858B876D8447385DCFCDD97E91FEBCD216638A92B14ECA6B5AF52C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 401KB
SHA256 569664398afd2d61516d4e79e6e62738f2f03a3d8821bcdde9b6268c8dbe9f75
MD5 4ff5bd70179ef5269c1728dbdbf74a07
SHA1 4de4e59a7b27a5d9905cabdbc4d0a7981241739b
SHA512 b3a2bb243f6c5ef34e2b2eae052b0d4c2fa9037b55e9038f5b76bc376b746f746f1cac71ab74b9f2d6353e24f808b549b658ad9954f1ed6d63e03db651c5cfa8
SSDEEP 12288:P6JUnWUGAop/SfI4Gl97/aGPVM0LB2mMSj:PZW3AtQ597/9tP4ij
TLSH
T1D7942370883BAE4C1D5F3738986FD93005A4ED37606B02C9D25DE969E8043977FA9E0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f1
Size 157KB
SHA256 0e225fcd1eb02b22a10607306f746629b3cc85280f33e2fa396b5698343c6123
MD5 62b4e3895dc70d68d3523e6b3915fcfe
SHA1 11ba13365bbb7094a294eb228d7f7587d1f6f65e
SHA512 71afc430c4fa180ba2616d60d21b044ea4dfe36e8dba0a70fa3d3575e66b8ae1c49884072064d658fedc543dc5750c95634acb115058d8bce5fcc1b30bb2aafb
SSDEEP 3072:iWckJ4FamVOa1b9vrtg1ZbxTipjAoQbKmVoqZpyXKGGAqqb7IWdyN:ipI76OWRG1R1i6yemrfu
TLSH
T118F312ECC36914B46BD9D872F3E444D3A384942396B4D4C8259A36F57C73E4EAFB0606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f2
Size 263KB
SHA256 fbd57d858f9518bb274dd5ed0da3e5fb94cbfae6ba0625e6ab9021d7cd0412ba
MD5 61c8ade267d86e402b9526adc2319613
SHA1 dc7005518532ac5076cb61e151cad30e2779ec06
SHA512 87a7f299d4c0273be10a00ac7b0c05e7095479ade2a2fedda86641ff3892025201a2dbdc17ee12669043c6e56ea04d7139f43d405f2af7681ea81a035d7a1091
SSDEEP 6144:W7jON0neRz/cL+6gn8WK5jCecaiEaUuY9jZ0f6NScmdnLxI:WVneRT6gn8WKETai1UV8vc+LxI
TLSH
T1EC4423F55218F139E217C6C45B994BD15DF89F02E92E9CE3C9113100EBA1897A3ED68F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f3
Size 169KB
SHA256 00b06ace15b28bb04139207a77cf89fb684c277ded18f6206fb56b5ef59804d5
MD5 f30ff1e283b8143e7273898a9820246a
SHA1 7aa5b6e425766cf0bcaedb285a523f532d7c636e
SHA512 fbd48e404b488ca80bc195669cc2a61f206687e3355bfe32c690777f70c997db95c9d6d8b917f1c8fd0093a97eec16e3f7ebbf7ecdaf73343bc62c2a72312f39
SSDEEP 3072:fGbs390bH5zn78Qst38daZvwqteWv7dY37EVOopff495pDNL54+sC:+E0bVwQwMda9bwWv7qQVOGe/LSi
TLSH
T1CF041277832B0655FC1104797723E9786CDF36794AE4AC2810E456CF99BF1298C0DEDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f4
Size 32KB
SHA256 5b3c4884e942b40d28d5e20dc9b7c49c71578c87a3c81268be2ad85f055c8f2a
MD5 8691aed2b9ed53d5b4a77ae582e885aa
SHA1 dd1a79635b414753df046d4f2c8642709869da56
SHA512 f9431cba738aea923525663aa93343f8f2a6940b0c3c404240e780d7d30ed4827c63b44eb029c40972b7accf5ef1a87f38cb6214b1f35b699d30d3110cc704ae
SSDEEP 768:7cm3AEB7pKDKP4AQb5AXVgGRzSex8pP9UmJHasy:7cm3A2ADrAQbIVgGV/8l9UmJHq
TLSH
T187E2E1E3C98103953E26908B5BE35C6318BFAC4759EEDC1DA0E41698F1361877F2898F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f5
Size 20KB
SHA256 d6b61e8c88e8cc9f68ac4a914301687bfe6459a306fbc068c4b86d502829a43a
MD5 35f6e927b743e5c51edc69e69172b68c
SHA1 55ca6147aebdd8e6736337bc55b4ec4a7eaabd99
SHA512 b37ecdab691c2934c3597231a61bf6f87cc7c017a156c6bc1031200c6400e2d79054fc337d2dd71b38aece7f8edb717580452d61115482e63a862e65ac287b37
SSDEEP 384:ykoehdcUKo7v+IBUWQYWwITdl7oyT1nwWAriBenbt/eTK7jl4:ykBOU1DZqYRGdeW+Jicbt/I4R4
TLSH
T1A092E147933F53EEAADE24B0474D7FCCA522BB574F8A154C0A19E30912807896C7A3B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f6
Size 16KB
SHA256 782d82b3941ab1891854ed5ed985ed01f1c09f725c139d51ae921c902869a465
MD5 1566fbd35b63f6037e6ba2854e62f671
SHA1 483dadd6430eb20ed61428db7579162a302c21fa
SHA512 f5fad787ebe2f42fe9c4e886af4a3e254902282e450ccf8ec56be3084ccd1b0bae72eb42db603abb8fac901d2361f69662fe1898162f1c6a2455922996b18072
SSDEEP 384:SVROgZE0p9PKrPN6qP2B2RIoBS8LzBDnvJVQIW5:SV9RPePkqP2BQIqDnxVQ/5
TLSH
T13472C07E1512EC97B59A251F118E05FCEEE0DF2786C4B400CD496643F9C7AA848BCE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f7
Size 123KB
SHA256 db161c1840a82ca72b4e037a34d57f9589afb641619a5ca9a5beade2c6c6e32d
MD5 ef07e00023a8a27752697e45fd11fcd2
SHA1 5051b2011dc04267fda7452f03095136e6ed067b
SHA512 0b219533c7465b35814afedf473135ae217dcb9f51470f33318f538f79a00de0d91e191b731848b1cbeec23e2d61dcaaf27388680c1b5af2506bb227bde2e983
SSDEEP 3072:CUKGGjlGel6/hrmNNXq+aOMIm5Gw0PYzZ7U1RjbKOGQN9oeni0:CXM+N7AnlZU1lWxK9oe/
TLSH
T195C3128DCD4E543C3BF028541378AD4CE250632E19796328973ABF5A7A95D31CBE7C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f8
Size 59KB
SHA256 0beb2b49eb3c530408ab26d852f699cfb133f7c45e5ddfab26be9f506c30d552
MD5 e6f9c2d5a74a3e5d1f4ec8a81c969438
SHA1 a7e668dd69f695c84901bc7f326b5b3fcc7dfad6
SHA512 38903301cfd9a77d72f621b5a9ec8c4756d5f670376f08fc601288e295e2cc161e14e08a30cdc7c8c97fbbd4ac996cbae95748bb7e11429e06df7c6b03b27985
SSDEEP 1536:HQaq1Q7XOos5ZBIp+1Zr52IGmCJijm1qAxTe9wzQ:fq1HoUBIpU5TG7JSmwuTe+8
TLSH
T1B45302AF9BC5FDA5590C0AAAC197003156297BF251FCF0C880C372D598E127F70AAE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f9
Size 113KB
SHA256 301fa2eadd943219b221032eb7b44b55e8612c64c664f73c2ad3e901d59e48a7
MD5 e7ea2e1a8702181eebaadaa7c1b83eec
SHA1 92054662f714cf52da445ff95864d8317252fe1f
SHA512 66a19309ac523b61d39610379404fea16ce6f6c555d1a10fc39bbfda83259adfe954ae7e9479ea5b9a448d7364c88675b030f44dddf83d8d5435b3e84d36b69d
SSDEEP 3072:9444uPD1FxElyk28B849i8JFL+HwhbjhbN9Za3H6HuW:94VuPD1eyk28B80l+QFjT9ZaU
TLSH
T109B312542C74B3BD2431C4A2D76ED5D47852F313920BD23B26E15BA720C4AC7BDDDA46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8e4aa508e3f4ebae3b293fbc03087ba659637ab9b884cfd398cebca3e3ee6a81
MD5 5965451f560b0dd04ba3cf5d970e2861
SHA1 9b9257ea84c17aa0db5d731c98d077ba9af4ec1e
SHA512 16cd4ba61ad1dc8a117fe776c8dd1e8830554b324bb310a34d527455a49fa3cda955280887bbfb2b90e8423a63f5c822173a6e8164b775c8b20e035cfb92ce65
TLSH
T1DF8160916CD6EA6BEFE0067A16CD3024B174951B8FBB4E3311C2937C5A96F23700C894
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58753b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58753b.TMP
Size 3KB
SHA256 53400008e703424c8759d455c3cdf626f5ab77a910a8a68796d8ec84ab35200d
MD5 791fa10357955ffc2af7f66bf5b9749c
SHA1 2d3e5fa264018d47aad6fe7e03744fc7ec33f6a3
SHA512 c6e4370783b9378a68e9e1d4b0e8e4f7d5a71cf5f578c23fb1174932cf3fadf2ef6e7994325e958a2d538b1eed962c3873bd345f473a727d95380c7863f55c25
TLSH
T150616C945CD6C868EFE400BF0A8E3029F174692B83BF4E7312D6633D9A0AF23710C840
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 28KB
SHA256 df8166cb9e742c7fc6b3f8eb33129b480b94c75fcb22396ee543e2dd9e2840c0
MD5 f24ec4368f3d21dc7cb7ffc42ed299fc
SHA1 1f4d055fa57e396a3b7d601ba657135a057b2f3b
SHA512 af3e922805b8fe3074d683a9e2ff3634475591ad7c4c3e05d1b1736198e183b0cf44cd7d7fa41b74157c08dae436b4597205a713293c015f76d34511cb698582
SSDEEP 768:JuCCviAPeyajao4zivyicFXiEkM1MsziZ8jsE:HAQv3cUOjsE
TLSH
T148D26821B5F9521AF27B5FBBA8B267515CBABE562D04C81D5860621D4C31F40CCB3F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 343B
SHA256 ec04723a856f8c7e9dbb46d32760117286eb52c8c163cfc028a7ff3a7ce1b65d
MD5 2ab2741cba7779bc662c6022062d8592
SHA1 6204494cbf94faf9cc75efa3d35ef1d29894f4d1
SHA512 1ca3e867405dc72cee8461f1a25a35c04c345903346bee4e8a65c030facac487ee913e57dbc89e483aac6d86a1df2fe8f916efc8aab7d0280f758de4becb6bd0
TLSH
T1F0E0D87888C9C21F915451DA8935BF4BD6E7760FA68C6F850E0FC8447043484F4AD271
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 c50353f7f7447ad8ef5fff23e25c872baf8d8570bea4b2d09e857ae342a707cf
MD5 a04f60aee2f84eae0186b46b9eed30d7
SHA1 bc3da8c004a1ed1a569af2d71281ee97208819ca
SHA512 c8c3373f559c28bde9403e3c15fae37fbbed84cd36f932ef4467bdd69fbc4f286a64285e98607ddaef0f49a058b6991f9e1b848d8efa0f20cb98ccc95d8a0515
SSDEEP 192:DnTzx+uO6auaPShj6Vq36nQScZxeP7g7+tjTHkuEG96GAYieMUL54T:DnTzx+uO6auaPShGVq36nQScZxeP7g7p
TLSH
T1E1F1BAF383A5862DDA1195F0AA18AF1FCF1C0556436C3D5A85D4AF0BA3F2871E141B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9ff69146d7c7da386f0a403ae7ed039ff2f1e9b67c0bee294e0337ede0edf599
MD5 76819f431ac5b111c01a8ee890af5026
SHA1 c8a25fb1dc43747b3eb0fa02955f2d3fcaa23c7a
SHA512 9b9c201d4d28d007deb95b609f20dafbd122a95cd38da2705253ef5ded42c0af6eca8b047b74d8f2c104ebc170c69b5297faa2c919eca22179e7e36453917bbc
SSDEEP 192:sxZQ/yM//K1Ml8MoQ/fysp26lYRbE2IdpKl7y/W6+WNe21L/Y0XI/VczIg4J:sxZQ/QQ/fysg6wg3h/bRL/5owc
TLSH
T10752E9126A349E77CCDBD219F955BF63D6F95472D2900D489AFCCA0C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 1cc36203675f3dbf0d482963684e2ec7a89a523722cb5ce388d9b5ed5184d575
MD5 c6c222805f0241ece55671f9dd01b155
SHA1 df0d00ee73efabaf048bc9aacd0651ae1ca70496
SHA512 6edcdf36b8bd1479b97ad85d6a4a39a744cfec6357813f7c2577f79d745d63264c346f08e61521d884ba824ae329d6eca6abebaac9b01e2b1b1bc43dd37c4a8f
SSDEEP 384:sxZg/QQ/fysJIwUsjQG/biIyCzTtx4/ohpVwj:sIIQ/fPImF/biDkJxqs3u
TLSH
T16992B642A5340D778CEBD61AB906FB56E6F89463D6904D48AAFCCE0C04E6BED6213C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 58cd8ca5296ced4c8926cb12b18f8627282a364a4e285c8bc2a434f64e5b251c
MD5 a14ec33befa315ad65db6f3f7be5287a
SHA1 eaaf2899205fcef4fa3f82548a99c1047aa51e29
SHA512 4217d363dedae5287d3a87c61e3aefd3df2913f086fb1124a2efbf8e299eb3d75ea57626107ac67eac631daff2e4b74e4b9ca7eecbfe5d9dfc830bb64306c8b1
SSDEEP 384:sxZg/qWQ/fysJIwasjQz/bxI1/KCzTtx4/ohNVwj:sICWQ/fPI4c/bxECkJxqsLu
TLSH
T1B892C743A5340A77CCE7D21AB906FB56E6F89463D6904D48AAFCCE0C04E6BED6213C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 9990b3dd3e4071953af920b2cca32c223c26701e038d464e125a88d89aff463c
MD5 ceafd2349daa3d0f0e8f4812529f86bb
SHA1 3722e725afeed48bec50525ad19fd2538039aa20
SHA512 ba659567ca1f727a97387f9f9bd186086c3b93bdd4a90a3d386777e6a5ae0f97660f718b9ff03243709592d23329c0918a3ef724ed74db1fbb8b19feb87fe391
SSDEEP 384:sxZh/QQ/fysJIwgsjQf/boILTtx4/ohGwj:sZIQ/fPIG4/bomJxqsGu
TLSH
T1A672D802A9245D778CEBD219B916BF53E6F85062D6904D48A5FCCE0C04E6BED2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 85da32b82b191bdf26255f2af453570c28074914a4f929f9c4d7d96566f9d2c2
MD5 92c0764001bb014a9761d2f8fc4f9589
SHA1 1228609e22efe4dfa0bcc66a06e84412c94a7dff
SHA512 8e909642db1f41535f0fb8096ffa243d380a28faf76c763fd2bf9fd17407fd7e56a161b7d8e4c684166476da405c416ee29d4e86f2b4c98b5ed167f89b2aafb1
SSDEEP 768:OxTTF8J52c/7pLuLnYwWRmY4QPU8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3nNmfLlU:OxTTF8J52c5EnYwWRmY4QPUu1jaKnNm6
TLSH
T117030C3B2C0CCB7E4F844E9CEC26BF9A6DE8018B9698C99447FA444C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\27331ed2-6d35-41a3-9524-a07f7617b6e1\index-dir\the-real-index
Size 72B
SHA256 2ef5c1c923fe409fa7df5077cce0a98ae7a5e2671f49666bee8f3d7ad98896b0
MD5 1863ef9eefb20fdc6930af327d9abb21
SHA1 ca335c7f3cdfa79a7201bb042947bedeeb635666
SHA512 00f33d5c492f132f1c87ec644ab1682f3e55b12b89d1411d1f829f60ade773a05af50e6fd24d8c912376cead59e3b91a93f379fa6c83e83c4f9f429260d84375
TLSH
T17FA0021939904311DD081378584217D1A6575C10211503E584A605C58CB1BD1918709C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591255.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\27331ed2-6d35-41a3-9524-a07f7617b6e1\index-dir\the-real-index~RFe591255.TMP
Size 48B
SHA256 220f500f0793ca2d9289d9946c3c7b844be4ec392de5bdd461d71f5fd8c97e83
MD5 26b4549495fb070316828e739fca065c
SHA1 812e5cd16ef2310edbf31e88c633a957ae6902e0
SHA512 9b6fe2042a1c531e2ecd198d1f2ce2e12e79496be37ab21fd4bf4c4fd80dd0020645aee4d8b1098431be66de7ebf3bac59b77634b13090fd8f412524a7d191d3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\29f82bdf-5137-47fc-84db-12b63379496e\index-dir\the-real-index
Size 72B
SHA256 71a39170e9c49e44355f942d350e73c2b21c9377569e30116fb9ef72c55716be
MD5 4accce3264d6bbd928328f572275d2f1
SHA1 1ba2914f028ef8815aabc09ffb8be50c7ca6528e
SHA512 780028991499cd3c867433eea8410921571f84d973a0f7cf415ae4433cac3c4586a838be4c7674a0a2d93dca683f1f501065dac051a3324c6ba80b62865699c6
TLSH
T1E0A0022031664575D00207B6618331512314FC6501094F0760B805E5CC95AFD6D02148
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48166f30-78f6-4da5-98a5-a0ff368b9888\index-dir\the-real-index
Size 3KB
SHA256 e0ad780110339067b8e134ff83feb4fc38caf76cb782ff01349afd1de7fa8336
MD5 7d0b7815a1f9629abc31bb1617736177
SHA1 6e0fd04735e861df843e09e8ffad0ea0c4016899
SHA512 d487603f4054c6104b5307614346a386d07559347658a943d8bbe1b4f0e7b86b9e2970d74961466953f3b1dc09f7b56d16f584ae0be2928f9409d7624f8d931c
TLSH
T1FF51DA8C5D479B7AC8BC51F25AF60891337D1ADE57B09A03187C2539748773E1E8B149
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5928db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48166f30-78f6-4da5-98a5-a0ff368b9888\index-dir\the-real-index~RFe5928db.TMP
Size 2KB
SHA256 1686c9692ac4c9abe10645f2c1863105c60bbee4bef9580325c2e620a70bbb9c
MD5 9a55f5969b46fe8dc8089d2baa9a0859
SHA1 8a9ec81a3f53c57c5c3146b4dc070057ecfbb5f2
SHA512 a38baec6745639f794f008686eebabb271ef8f8c7d48e4b5896320bb9fc7c4f90777b0463a263b245c245badafd1643d2c8475fbd7052aac56b22f3de3007bd8
TLSH
T19351B79E9C430A32CDA095B345CA6465333D68554E49AF0735FC8A33ACC77AD3D56354
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a0feea58-0528-4786-bcab-29a71cde3c37\index-dir\the-real-index
Size 72B
SHA256 c6bc5c2dd3c811c4d10ffe2b340603833eb859d79b4ea06d952b3cb3c1c183ea
MD5 b32c793a898a6780ad8c0a5d29c88261
SHA1 baf7207d3a89e21fc266abb598bab004c68e160c
SHA512 91714857a59a9bd6c5e0243ffd26448686977ba98c85d5a6e0cc4633f317309c4821c263927809d0798ca192fb28a9dd94a72f7e2652b2288f200cb0a3752a4d
TLSH
T120A002509AC48113C04726B5BA935345B311CCB04206270741A10044CCA0B804A8141C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59049a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a0feea58-0528-4786-bcab-29a71cde3c37\index-dir\the-real-index~RFe59049a.TMP
Size 72B
SHA256 623b35598603e3701aaf9b6d02103ad8707cc9e2cb7c2cb16d3a7ae0faa61ac0
MD5 82ff5de33a42cfda7da792d3e679b5fa
SHA1 1079956bc4fe227fac2ead681761d8c20bcfa64a
SHA512 4607f9bef0e3b0fe4de2a02d6be7f2d37a4281276f5c59f15765d4b804671a8d7ab9ba4a9d17417eac3ce65dcf6cc0c4d6e51fe16acd0cef5886f79e8350d873
TLSH
T1D0A002DC03A21906E01711B2665276819301CC101122A20E56910154DD60D41B55104D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 f8676ff4ec18a306f4fbfa9bc1fea75d3a968087a4183bf9463a8c4ceb9f2375
MD5 fadbf102211872810f8b8c5e54caaeba
SHA1 27bdd8f91d294b6e22e13b43c8ccb5749ba2cf9b
SHA512 46a6e954d58c49c7e0d6fe873f098b54a36ea69d093e27498fb297c66406e0c8ef26e9b4e7fc11a68de459b81c7844bb79dedfb07335176a84938c0243afcb06
TLSH
T1C3F097B73DFB1920FCABD3D2203000A10541B959C060EC5E104A238380B231434ADCA6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 fb883c6863dca86a194c175046af353bbc9962f4898a3ba4ab30361919fbc408
MD5 71f431a161f8a4f77682bbce45e40195
SHA1 c26af8c69fce0fab0578920dd5143ea28bc4eb68
SHA512 a947aff7792dee19326ce141add2878dc82301f2fa1c1312b59582960f4731febb9e5e8ba0cf12c3b123c96533a497ca01bea70ee62dc5701408341037e67829
TLSH
T122F020B73EFB2D24FCABD3D2207114A10595BD5DC451ED1E205A738390B231634AECAA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 af016357455caf050ce3b8ee1ba027e70432f77ec14e5d0322db3e164b6213e9
MD5 c15eac27aa11f5e024cde40aae4f408f
SHA1 d430a417d561e956d0344c2023038e00ce8ab62d
SHA512 050a46f2863b3f9d2e931eabe5cc4626793c003e89eb39d041c2edfe144e95bb612c16201b7c43459a524c1cd9d755328dae548eb926536950e727d131d291c2
TLSH
T1D4A00293DF789585D60002B8B4B602892260CDAC274A3A1550AD12E49850BC1C592A14
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592457.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592457.TMP
Size 72B
SHA256 2546d3519b666a2eee4db237f2aa46f09a4f77ef24d324c0d9885c986c03a143
MD5 1e8c5807d85a1260a8deed47174b907c
SHA1 ff753386f287e0fe8497a7bc9a93bb39ba5cd600
SHA512 e96d3ef3930fec59edf664de8fc643b1c06634637f20d3d09b7dc4d2fb70f07ee56c16862f66801f69c3b4cdab0e3284cb1f9435dc946b884efa67deeb5b9450
TLSH
T144A00264864A5410C40816B91415324013758899010123029596E1EDEDA54C95DC1503
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 763108e621f16656750fccf2df8bd65ebb3f93b3ff20af7bf0766bbede16a62d
MD5 3db5645e7367865dcda5a9489e50a8f0
SHA1 01f03673e102caf339972b7ad4062a2249f939b4
SHA512 a261b47bcd9edcc41d06f5719fe50c4e8b4dd939380a2fe8107836ca18ccda743c76309c9005466b8e153dc7048b408dcf4d4a83cbfb75abdfc9e5bf68810377
SSDEEP 96:KwzeKc4mW3KK0YCq4QKhymQIKhWWKowKViR:YF9JfuXPW
TLSH
T120E1D051B57A13803A7E269A91D4B47A46C270A37818A43B7BFC11A60F67F60CCFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f4cb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f4cb.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6f74fc662ea49e3f54c244b01464272de2cf5e97c368e7e0975c80bee187542a
MD5 f068bddd992fa96ce50644312aa8c795
SHA1 f4c7e4820e84c8939a096bb108d5d052b3d8da38
SHA512 ad68e8a9d4627a9ed504936ef35109b340ff138369312a26b9250089c34af559a005c575eb65c3adf779bc4d620ede65ca720987b82345357eb6865279720a29
SSDEEP 384:n7iFfKXPqXynoJ8NK8TUNTUlIlQBTvZ7lYOzX2jDfYac/Tp+l1U3sssAup50y:WF6PNnG3wgiz9zXrac/NcusLAmh
TLSH
T1B8D292F198D78936D9AE4B83A33E7D529EBCC06775845994BB885E0CCC871BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cfc5f09b5c5ee313d35b3360d956431c8ad9fddc2649fa67eff3db1c056b5d7d
MD5 1fc70cf4da6b50464e8962521df1af84
SHA1 a5ac0f7c449ef920e634c0d68a2e72c510c15939
SHA512 fdf6d08bedee4d39495179e803cff6769c861c548d3c4378ef49125a06877c0bcd33302c006043c220705afa7cd9c40a96ab40fbdc692e0df833684029cf9b90
SSDEEP 384:ncKXPqXynoA8NydBZZ7lpO2Wkc/Tp+l1UFsssAup50y:vPNnRTFO29c/NcWsLAmh
TLSH
T1D8826E716C791C779AE3AE02F10B3A63AF74507FA2C01E98D9D95B0D05CB29C131B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 448a78f67f5e58ed0d393aa27a07d2cced940847582c85cf5596273a9c66dc55
MD5 4ac24c62fad58fa69443d27ac7873132
SHA1 f9f50f700e73de43f1065e9208249d7c54b978e4
SHA512 6950824c3a8b3b7d7d5784c801600f2abffd9aaabda8eb265d3296e7a1f7943a4bfde8d437336a3f568b0ef23891ce13a5755df268ade28ac0c00dfd84d0f4bf
SSDEEP 384:n4KXPqXynoA8NyQBZZ7lIO2Wkc/Tp+l1UesssAup50y:zPNnRaF929c/NcxsLAmh
TLSH
T17E826D716C791C779AE3AE42F10B3A63AF74507FA2C41E98DAD85B0D05CB29C131B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 232942dee4028c9dd66b5a7c33c78a3f1e86e7d5cd18de8364bc7d69449d92f8
MD5 782d0737c392bd5ef8440a117701bf39
SHA1 e16d42b699c096a31e9f55394864b6862ddb79d1
SHA512 029ef56e9703f070cc9ef8b073c90233509337e098de5b781e03035a50288cebc772b2195b3ca22581e083a67b38811cdbe9a306d320d0b268bcdfcdad19734e
SSDEEP 192:iGNT6IMGEQmiUyvZkCxc/Tp+l12og+S66Jrqa4U6:iGNT6GUKuCxc/Tp+l1UxsU6
TLSH
T18D12097168786CB79EE3AE51B04B7A33AF90117BE6851F99C9D81B1C05DB69C1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b33f15bbb9975c09f17fb3c00083bc627227f7eb6d359f87a42056bf69601f86
MD5 86cee29938d24fc099663aaba4a772ea
SHA1 ca4648abe99641dff6f7e8390e8b33c3fdec90d6
SHA512 4e46bff820d07ffd0be46f8a0a89c8d32ebaf373e09cc2ffbdb0e8ec2d2a404049de6dbaa45d81ae26bc3a8d15d994f2b36e527d31b4342eab95cf394b673b97
SSDEEP 192:lGNb6IMGEQmiUy3Tk6xc/Tp+nSepkeWeLU6:lGNb6GU0Y6xc/Tp+dnXLU6
TLSH
T1A502E83168786CBB9EE36E45B0473733AF94216BEA941F98C9D81B1C05DB69C1302822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 63be33fa5cac9c9c35965e61ea91b4e5bf225e561b9c735c7989b3b0d9dd6477
MD5 b2c40ce44239e4ea1d9151dd94fa2030
SHA1 9c902af94bc94ef66fa01afa46bd793c03640229
SHA512 b5bfd3ed597513e69347c141be05a828b24c8c75eff10ac1e5c59ad32aa064fbed186dea8c5f94cc5e922d64c5f72f2dbd48cf6b1532bb27cc25efcc11b217ce
SSDEEP 384:nuKXPqXynof8NyRBZZ7l4O2Wkc/Tp+l1UFsssAup50y:9PNnmzFV29c/NcWsLAmh
TLSH
T1B6826D716C791C779AE3AF42F10B3A23AF7450BFA2C01E98D9D95B0D05DB29C131B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5d49ccc73ea8a5a493850d948a7b8f3aec484259dbcd836652ff2005fb3953ef
MD5 15201e944768ff1ebc6a6da9a40f2d2c
SHA1 f37e2a60b95e5bc774399b132974cb08c41335d4
SHA512 a8b961bf305bb0941c73aafa5607d82d1b7d936c77e2c7c884b2be2922733f83d00ff489ffb75dd0b3c3d62f0a94f409a35318e41c44916bd9b36d39e0dd34e8
TLSH
T133E00283F30004BED03857300183163136EA9030137342465D2003643C133001F24BE0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a0564f25dee426d13a04fbb5d05f48bdc9f072164f0fe3dfccc71de50c264b1c
MD5 36c44d5d58a70340d6ddb835f9c6cc32
SHA1 650ea178881a44686f9c72edd81abfbf3facdc29
SHA512 fa1faee7b6f50a5697182ed59af97e97e22c843085cb3dba4430542a10179183ddcc45a7261289baf4e53b859cb3bf2e59678f202d00596ce0491ae773e230ab
TLSH
T1A1E00982A30004AAD028573442832F327AEA9028537383469F32266C3C233013B24BA0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ae5feab11c699ff98a7a93608dce5516d6245cf68d3af24f9d55dd02186ff9a0
MD5 a2fcefb06f261d8aac1cf52dd5c8a227
SHA1 26b0a949671cd6ee4bb31ec4ce70848e85f777b4
SHA512 c98d043ecf93b0d1d19920ca68e75daaeff4dd6e5bdfd130495a7634537a8fcf5362e82dc27138b0ae09cc9397a236496ca7e8a312e68d26c07fa986156fba52
TLSH
T144E00183F30004ABD038573441C31B313BEA9020237243465E2212683C233012F24BE0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 694cbc1ee9f4047e10fc30b8c767f900a93531850d0411d46a6876603ef9c886
MD5 39a72f6b5e530414115367e4657b03bd
SHA1 1bcefc11f91f5ba5e8aeb4673f7302c0d39beff3
SHA512 89719c389ef39cd9b4cfcd215750e8b69906663d55126e4d5643557b054e31de03ebfca062c9c7d3f0d5aa7b0876268f7616fbc3e761b09e867dea44d1ec9889
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58d695.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58d695.TMP
Size 392B
SHA256 79b1d515345a328de2303140a30586c0041434995d1edd935daa6abc73539c39
MD5 451aa289b3901d6315ad49ffd13d7d0d
SHA1 9b0c6fed806d7e409a67704e45ac228ccf297ba8
SHA512 6a110ac38567f2fec8e2c610dcd1970ebb20fc5deefe771e930757b8e996e3871085f9c7b4270327b88837722e677e813b4b6b881a6e2b0f2fa6a81803c7333b
MD5 SHA1 SHA512

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

f5ec58a4-8ae4-4185-8e61-48869a3f72f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f5ec58a4-8ae4-4185-8e61-48869a3f72f7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

d49206f2-53f7-4f9f-9f3d-7100bfb85d72.tmp

Path C:\Users\Admin\AppData\Local\Temp\d49206f2-53f7-4f9f-9f3d-7100bfb85d72.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f32b1b74-ef7d-4969-9a6d-448672728a9c.tmp

Path C:\Users\Admin\AppData\Local\Temp\f32b1b74-ef7d-4969-9a6d-448672728a9c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1336_1920633934\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9155d63-66f9-4733-8d5a-a38d8f987175.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1336_245691310\c9155d63-66f9-4733-8d5a-a38d8f987175.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1336_125656305\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1336_1336503622\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1336_827033788\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1080-130-0x0000019584440000-0x000001958452A000-memory.dmp

Download

memory/2908-597-0x00000232E5150000-0x00000232E523A000-memory.dmp

Download

memory/3568-599-0x000002C9F9230000-0x000002C9F934E000-memory.dmp

Download

memory/4532-1750-0x0000020FAE610000-0x0000020FAE6FA000-memory.dmp

Download

memory/4532-1778-0x0000020FAE610000-0x0000020FAE6FA000-memory.dmp

Download

memory/4648-1824-0x000001D7E0890000-0x000001D7E097A000-memory.dmp

Download